Dark web markets persist despite forum closures, arrests, and disruption efforts. Criminal organizations swiftly adapt by utilizing new platforms, replica forums, encrypted channels, and private brokers. For enterprise defenders, market trends reveal valuable insights: they indicate which assets attackers prioritize and where criminal investment is increasing.
Low-cost stolen data remains accessible; US Social Security numbers can be purchased for as little as a few dollars, while basic personal information such as names and email addresses fetches less than $15. Complete identity theft kits, known as "fullz," typically consist of a victim's name, address, Social Security number, and date of birth. Stealer malware has further exacerbated this issue by collecting usernames, passwords, browser data, cookies, and cryptocurrency wallets from infected devices.
Attackers can easily purchase stolen credentials for minimal cost, test them automatically against various cloud services, and use reused passwords to gain unauthorized access to corporate systems. Their listings include various types of access, such as VPN connections, remote desktop credentials, web shell access, cloud tenant accounts, or compromised employee devices. In 2025, average listing prices surged significantly due to a small number of highly-valued listings involving major enterprises.
Financial services, healthcare, manufacturing, and critical infrastructure continue to be attractive due to the potential for significant returns from disruption, data theft, and extortion attacks.
